Hermes
23f636a501
build / build (push) Failing after 13s
- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.
63 lines
2.7 KiB
Docker
63 lines
2.7 KiB
Docker
# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
|
|
# streamable-HTTP container for cluster0.
|
|
#
|
|
# Built by Gitea Actions (.gitea/workflows/build.yaml):
|
|
# - on push to main
|
|
# - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
|
|
# the tag is already published) — lands ~7h BEFORE the cluster0
|
|
# image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
|
|
# deployment tag like any other app.
|
|
# - on manual workflow_dispatch with an explicit version
|
|
#
|
|
# The upstream release is a SINGLE static Go binary, fetched from the pinned
|
|
# GitHub release and verified against the release's own sha256 checksums
|
|
# file. No vendored code. Published as
|
|
# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
|
|
#
|
|
# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
|
|
# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
|
|
# this image — the token comes from the server's own Kubernetes secret
|
|
# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
|
|
|
|
ARG MCP_GRAFANA_VERSION=v1.1.0
|
|
|
|
FROM docker.io/library/alpine:3.22 AS fetch
|
|
|
|
ARG MCP_GRAFANA_VERSION
|
|
ARG TARGETARCH
|
|
|
|
# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
|
|
# upstream release. ca-certificates for HTTPS to github.com.
|
|
RUN apk add --no-cache curl tar coreutils ca-certificates
|
|
|
|
WORKDIR /tmp
|
|
|
|
# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
|
|
# verify the tarball's sha256 against the checksums file. Fails the build on
|
|
# any mismatch (checksums.txt entries: "<sha256> mcp-grafana_Linux_<arch>.tar.gz").
|
|
RUN set -eux; \
|
|
SHORT="${MCP_GRAFANA_VERSION#v}"; \
|
|
case "$TARGETARCH" in \
|
|
amd64) ASSET="Linux_x86_64" ;; \
|
|
arm64) ASSET="Linux_arm64" ;; \
|
|
*) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
|
|
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \
|
|
grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
|
|
tar -xzf mcp.tar.gz mcp-grafana; \
|
|
chmod +x mcp-grafana
|
|
|
|
# The binary is fully static (no INTERP segment) — scratch is sufficient.
|
|
FROM scratch
|
|
|
|
COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
|
|
|
|
EXPOSE 3000
|
|
|
|
# streamable-http on all interfaces, port 3000 (the service port).
|
|
# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
|
|
# protection: only the in-cluster service hostname is trusted).
|
|
# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
|
|
ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]
|